Card Network Programs

Visa Dispute Condition 10.4 Evidence Rules Expand Across Tokens on October 24

Visa Compelling Evidence 3.0 under Dispute Condition 10.4 expands on October 24, 2026 to prior purchases on the same card or associated tokens, including across merchants an acquirer processed, when qualifying data elements match.

E-commerce 4 Internet Marketers Editorial

Illustration of two colleagues reviewing a laptop outdoors beside autumn maples on a cool October morning.

For Visa disputes processed on or after October 24, 2026, Compelling Evidence 3.0 (CE3.0) under Dispute Condition 10.4, Other Fraud, Card-Absent Environment, will accept prior undisputed purchases on the same card or on a payment credential tied to that card, including an additional token, and will allow those earlier purchases to come from one or more merchants. Analyses of the Visa Core Rules and Visa Product and Service Rules edition dated April 18, 2026 describe the rewrite as an expansion of the remedy that can make a qualifying 10.4 dispute invalid, which keeps liability with the issuer when the packet meets Visa’s criteria.

The same October window is where October network roundups also flag a clarification to Dispute Condition 12.2. Merchants that vault cards in Customer Information Manager (CIM) vaults, network tokens, or similar credential stores should treat the CE3.0 changes as confirmed by the public Visa rules text cited below, and confirm any 12.2 operational change with their acquirer before rewriting representment playbooks.

What Compelling Evidence 3.0 does on a 10.4

Condition 10.4 covers card-absent fraud claims in which the cardholder says they did not authorize or participate in an online or phone purchase. Since April 2023, Visa has allowed the merchant side to answer that claim with structured prior-purchase data rather than narrative argument alone. When the criteria are met, Visa treats the dispute as invalid instead of merely contested. Visa’s client materials also describe removal of the associated TC40 fraud report for CE3.0-qualified cases, which can affect Visa Acquiring Monitoring Program (VAMP) ratios depending on extract timing.

Through disputes processed on October 23, 2026, the two earlier transactions generally had to use the same payment credential at the same merchant. For disputes processed on or after October 24, according to a September 24, 2026 reading of the April rules by Pulse, the text accepts the same card or a credential associated with that card, such as a token, used at one or more merchants in two previous undisputed transactions. Pulse also notes a pre-arbitration footnote that limits the acquirer to transaction data it accepted and processed itself, so multi-merchant history is a portfolio asset rather than a network-wide lookup.

Tokens, common data elements, and what still has to match

High-risk merchants that store cards in Authorize.Net CIM, NMI Customer Vault, or network tokens often see a later chargeback arrive on a different token after an earlier credential was compromised or rotated. The October 24 wording is built for that pattern. Merchant Cost Consulting‘s October 2, 2026 network roundup summarized the 10.4 change as making transactions on all credentials tied to the same card, including additional tokens, eligible for liability shifts back to the issuer when they share common data elements. That shorthand matches the CE3.0 outcome when the packet qualifies, though the operative Visa mechanism is the invalid-dispute / pre-arbitration evidence rule rather than a separate automatic flip.

The matching work has not gone away. CE3.0 still needs two earlier undisputed transactions in the stated age window, product descriptions, and at least two qualifying data elements that match across the disputed sale and the priors. Chargewood, quoting footnote 9 to Table 11-28 in section 11.7.5.3 of the same April 18, 2026 rules edition, reports that for disputes processed on or after October 24, device ID and device fingerprint are treated as similar elements, so an acquirer may not supply both and must pick another element. Stripe’s current Visa CE3.0 API documentation already states that customer device fingerprint and customer device ID are not a valid evidence combination, and that Stripe must have processed the prior undisputed transactions used in the packet.

Practical pairings that survive that restriction include the cardholder’s public IP address plus a full delivery address, or the IP address plus the customer account or login ID used at purchase. Pulse lists the same element set Visa specifies in clear text, with device fingerprint as the only element that may be hashed, and notes that login IDs for an agentic payment provider will count as account or login ID evidence under the October 24 text.

Dispute Condition 12.2 in the same October window

Merchant Cost Consulting’s October roundup also states that on October 24 Visa is clarifying Dispute Condition 12.2 so that dispute rights exist when a merchant processes a new transaction to correct an error instead of processing a reversal. Visa’s public Dispute Management Guidelines for Visa Merchants already describe 12.2 as Incorrect Transaction Code, including cases where a credit refund was processed instead of a reversal or adjustment. PayPal’s Fall 2026 Release+ Guide, published September 4, 2026, does not list either the 10.4 CE3.0 expansion or a 12.2 clarification among its tabulated updates. Stores should therefore treat the 12.2 October date as an industry-roundup claim until their acquirer or ISO confirms the bulletin language that applies to their MIDs.

What vaulted and tokenized stores should check before October 24

Analysis. The operational question for a high-risk cart is whether the gateway and acquirer can produce CE3.0-ready identifiers across the vault and token lifecycle, not whether a brand has a polished chargeback letter template. Teams should ask whether public IP, login ID, and full shipping address are retained in clear text for at least the roughly 13-month span CE3.0 evidence can require, whether token refreshes still link back to the underlying account for matching, and whether the acquirer can search prior undisputed sales across merchants it processes when a multi-merchant packet would help. Stripe merchants can inspect enhanced eligibility status on dispute objects; merchants on other platforms need the same two-element receipt from whoever files pre-arbitration.

A first-purchase cardholder still has no CE3.0 path. Recurring merchant-initiated transactions can qualify using setup-time data elements where the rules allow, according to Visa FAQ material summarized by Pulse, but that does not excuse weak retention on the initial authenticated sale. Fabricated history remains monitored under Visa’s Fraud Dispute Monitoring Program, and multi-merchant evidence widens the data that program can scrutinize.

October 24 is a data and filing change, not a fee change

Visa’s October 24 CE3.0 rewrite for Condition 10.4 expands which credentials and which merchants can supply the two prior undisputed purchases that can invalidate a card-absent fraud dispute, and it tightens how device identifiers count as matching elements. Network roundups place a 12.2 clarification in the same window, but that point still needs acquirer confirmation. Merchants that vault and tokenize credentials should treat the date as a retention, matching, and pre-arbitration checklist, and they should verify the exact Visa bulletin language with the party that files their disputes before changing representment playbooks.

Sources